CLAIMS 

1 . A method for tracking a virus comprising: 
copying information from a first packet; 
passing through a second packet; 
5 saving the copied information; 

determining whether an infection has been received, wherein the infection is 
associated with a network transmission, and wherein the network transmission is also 
associated with the first packet; and 

retrieving the saved information. 
10 2. The method of claim 1, wherein the information includes a file system location. 

3. The method of claim 1, wherein the information includes a file name. 

4. The method of claim 1, wherein the information includes a network address of a 
source computer. 

5. The method of claim 1, wherein the information is saved on a receiving computer. 
15 6. The method of claim 1 , wherein the determination of when a virus has been 

received is performed when an attempt to write a file occurs. 

7. The method of claim 1, wherein the determination of when a virus has been 
received is performed when an attempt to open a file occurs. 

8. The method of claim 1, wherein the determination of when a virus has been 
20 received is performed when an attempt to read a file occurs. 

9. The method of claim 1 , wherein the determination of when a virus has been 
received is performed when an attempt to create a file occurs. 
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10. The method of claim 1, wherein the determination of when a virus has been 
received is performed when an attempt to delete a file occurs. 

1 1 . The method of claim 1, wherein the determination of when a virus has been 
received is performed when an attempt to access a file occurs. 

5 12. The method of claim 1, wherein the first packet and the second packet are both 
associated with a network transmission. 

13. The method of claim 1, wherein the first packet and the second packet are both 
associated with a network transmission, and wherein the network transmission includes a 
plurality of network packets. 
10 14. The method of claim 1 , further comprising copying information from a third 
packet and saving the copied information. 

15. The method of claim 1, further comprising copying and saving information from a 
plurality of packets, wherein the plurality of packets are a subset of a network 
transmission. 

15 16. The method of claim 15, further comprising passing through a second plurality of 
packets, wherein the second plurality of packets are a second subset of the network 
transmission. 

17. The method of claim 1, wherein information includes a username. 

1 8. The method of claim 1, wherein information includes a user credential. 
20 19. The method of claim 1, wherein information includes a name of a source 

computer. 

20. The method of claim 1, wherein information includes a netbios name. 
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2 1 . The method of claim 1 , wherein information includes a domain name service 
name. 

22. A system for tracking a virus comprising; 

a processor configured to copy information from a first packet; pass through a 
5 second packet; save the copied information; determine whether an infection has been 
received, wherein the infection is associated with a network transmission, and wherein 
the network transmission is also associated with the first packet; and retrieving the saved 
information ; and 

a memory coupled with the processor, wherein the memory is configured to 
1 0 provide the processor with instructions. 

23. A computer program product for tracking a virus, the computer program product 
being embodied in a computer readable medium and comprising computer instructions 
for: 

copying information from a first packet; 
1 5 passing through a second packet; 

saving the copied information; 

determining whether an infection has been received, wherein the infection is 
associated with a network transmission, and wherein the network transmission is also 
associated with the first packet; and 
20 retrieving the saved information. 
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